hemmieweizen

Saurabh, THANK YOU SO MUCH! This pointed me in the right direction and everything works perfectly now. For anyone that comes across this, below is what worked for me. The hidden field default custom value is set to {AgentRef_Cookie} and we’re using ?ref=test123 as the URL parameter for the cookie.

<?php
/*
Plugin Name: Forminator Cookie Handler
Description: Sets AgentRef cookie from URL ref parameter and populates Forminator form hidden field
Version: 1.21
*/

// Set AgentRef cookie from URL ref parameter
add_action('init', function() {
    // Check if ref parameter exists in URL
    if (isset($_GET['ref']) && !empty($_GET['ref'])) {
        // Sanitize the ref parameter to prevent XSS and invalid characters
        $ref_value = sanitize_text_field(wp_strip_all_tags($_GET['ref']));
        
        // Additional validation for expected format (e.g., alphanumeric with limited special characters)
        if (preg_match('/^[a-zA-Z0-9_-]+$/', $ref_value)) {
            // Set cookie to expire in 30 days
            setcookie('AgentRef', $ref_value, [
                'expires' => time() + (30 * DAY_IN_SECONDS),
                'path' => '/',
                'secure' => is_ssl(), // Only send cookie over HTTPS if site is using SSL
                'httponly' => true,  // Prevent JavaScript access to cookie
                'samesite' => 'Lax'  // Protect against CSRF
            ]);
            $_COOKIE['AgentRef'] = $ref_value; // Make available in current request
        }
    }
});

// Prepare the form data with the cookie value
add_filter('forminator_prepared_data', 'wpmudev_prepare_forminator_data', 10, 2);
function wpmudev_prepare_forminator_data($prepared_data, $module_object) {
    // Check if we're dealing with a custom form
    if ($module_object->model->form_type === 'custom_form') {
        // Replace 'hidden-1' with your actual hidden field ID
        $field_id = 'hidden-1';
        
        if (isset($_COOKIE['AgentRef']) && !empty($_COOKIE['AgentRef'])) {
            $prepared_data[$field_id] = sanitize_text_field($_COOKIE['AgentRef']);
        } else {
            $prepared_data[$field_id] = 'None';
        }
    }
    
    return $prepared_data;
}

// Update the submitted data before saving
add_action('forminator_custom_form_submit_before_set_fields', 'wpmudev_update_forminator_submission', 10, 3);
function wpmudev_update_forminator_submission($entry, $form_id, $field_data_array) {
    // Replace 'hidden-1' with your actual hidden field ID
    $field_id = 'hidden-1';
    
    // Get cookie value
    $cookie_value = isset($_COOKIE['AgentRef']) && !empty($_COOKIE['AgentRef']) 
        ? sanitize_text_field($_COOKIE['AgentRef']) 
        : 'None';
    
    // Update the field data array
    foreach ($field_data_array as &$field) {
        if ($field['name'] === $field_id) {
            $field['value'] = $cookie_value;
            break;
        }
    }
    
    // Update Forminator's field data array
    Forminator_CForm_Front_Action::$info['field_data_array'] = $field_data_array;
}

// Populate hidden field in DOM with cookie value
add_filter('forminator_field_hidden_field_value', 'wpmudev_populate_hidden_field_cookie_value', 10, 4);
function wpmudev_populate_hidden_field_cookie_value($value, $saved_value, $field, $hidden_field) {
    if ('custom_value' === $saved_value && '{AgentRef_Cookie}' === $value) {
        // Check if cookie exists and is not empty
        if (isset($_COOKIE['AgentRef']) && !empty($_COOKIE['AgentRef'])) {
            // Sanitize cookie value before assigning to form field
            $value = sanitize_text_field($_COOKIE['AgentRef']);
        } else {
            // Fallback value if cookie doesn't exist
            $value = 'None';
        }
    }
    return $value;
}
?>